Security and data

Where the data lives

The database, the accounts and the photos are kept by Supabase, in Dublin, Ireland.

Each account can only reach its own data: the database refuses the rest, row by row. Passwords are stored encrypted by Supabase, and we never see them.

Who handles the data

Only the providers Ementado cannot work without, all bound by data protection agreements:

• Supabase: the database, the accounts and the photos.
• Vercel: hosting for the site and its functions.
• Cloudflare: the bot check at sign-in.
• Stripe: payments and invoices.
• Resend: sending the emails.
• ImprovMX: forwarding email sent to ementado@ementado.pt to Gmail (Google).
• Google: signing in with Google and, only when you choose them, reading a menu from a photo and translations.

For table stickers, the printer only gets the print file, and the courier only what it needs to deliver.

Maps come from OpenStreetMap, which gets the address you search for in the editor and viewers’ IP addresses.

Some are US companies: transfers follow the rules approved by the European Commission. We never sell data or use it for advertising. The details are in our Privacy policy.

How we protect it

• Everything travels over HTTPS, and the site tells your browser never to open it without it.
• Account, admin and menu pages only run our own code, Stripe’s and Cloudflare’s, under a content security policy (CSP). On a Pro or Ultra menu, Google’s translator too, when the reader chooses another language under "More languages".
• Ementado’s admin only opens with two steps: the password and a code from a phone app.
• Your card number goes straight to Stripe: it never passes through us.
• Sign-in has a bot check, and the actions open to the public have limits against abuse.
• Every change to the code goes through automated checks before it goes live. Every week, a scan looks for known flaws on the site.
• We keep backups of the database for up to 8 weeks, to restore it if something fails.
• The site is monitored around the clock, and its status is on a public page.

See, correct or delete your data

See and correct your account and menu data in your dashboard, whenever you like.

To delete everything, use “Delete account” in your dashboard: your menus go offline and the data is deleted straight away. Only orders and payments are kept, for as long as the law requires.

To ask for a copy of your data, or anything else, write to ementado@ementado.pt: we reply within 30 days at most.

You can also complain to the Portuguese data protection authority, at cnpd.pt.

Found a security flaw?

Write to ementado@ementado.pt with the steps to see it. Please don’t test it on other people’s accounts or menus.

The same contact is in security.txt.